Vulnerability Description
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netfilter | Iptables | <= 1.4.21 |
References
- http://www.spinics.net/lists/netfilter-devel/msg21248.htmlPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=826702Issue TrackingMitigationPatch
- http://www.spinics.net/lists/netfilter-devel/msg21248.htmlPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=826702Issue TrackingMitigationPatch
FAQ
What is CVE-2012-2663?
CVE-2012-2663 is a vulnerability with a CVSS score of 7.5 (HIGH). extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. N...
How severe is CVE-2012-2663?
CVE-2012-2663 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-2663?
Check the references section above for vendor advisories and patch information. Affected products include: Netfilter Iptables.